Mirror/k3s
1
0
Fork 0
mirror of https://github.com/k3s-io/k3s.git synced 2024-06-07 19:41:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

Generation of certificates and keys for etcd gated if etcd is disabled. (#6998)

Browse Source 
Problem:
When support for etcd was added in 3957142, generation of certificates and keys for etcd was not gated behind use of managed etcd.
Keys are generated and distributed across servers even if managed etcd is not enabled.

Solution:
Allow generation of certificates and keys only if managed etc is enabled. Check config.DisableETCD flag.

Signed-off-by: Bartossh <lenartconsulting@gmail.com>
This commit is contained in:
Bartosz Lenart 2023-07-11 19:24:35 +02:00 committed by GitHub
parent 2eddfe6cf4
commit 34617390d0
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 12 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
pkg/daemons/control/deps/deps.go
View File

@ -446,6 +446,7 @@ func genServerCerts(config *config.Control) error {
} }
func genETCDCerts(config *config.Control) error { func genETCDCerts(config *config.Control) error {
runtime := config.Runtime runtime := config.Runtime
regen, err := createSigningCertKey("etcd-server", runtime.ETCDServerCA, runtime.ETCDServerCAKey) regen, err := createSigningCertKey("etcd-server", runtime.ETCDServerCA, runtime.ETCDServerCAKey)
if err != nil { if err != nil {
@ -455,13 +456,6 @@ func genETCDCerts(config *config.Control) error {
altNames := &certutil.AltNames{} altNames := &certutil.AltNames{}
addSANs(altNames, config.SANs) addSANs(altNames, config.SANs)
if _, err := createClientCertKey(regen, "etcd-server", nil,
altNames, []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth},
runtime.ETCDServerCA, runtime.ETCDServerCAKey,
runtime.ServerETCDCert, runtime.ServerETCDKey); err != nil {
return err
}
if _, err := createClientCertKey(regen, "etcd-client", nil, if _, err := createClientCertKey(regen, "etcd-client", nil,
nil, []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth}, nil, []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
runtime.ETCDServerCA, runtime.ETCDServerCAKey, runtime.ETCDServerCA, runtime.ETCDServerCAKey,
@ -481,6 +475,17 @@ func genETCDCerts(config *config.Control) error {
return err return err
} }
if config.DisableETCD {
return nil
}
if _, err := createClientCertKey(regen, "etcd-server", nil,
altNames, []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth},
runtime.ETCDServerCA, runtime.ETCDServerCAKey,
runtime.ServerETCDCert, runtime.ServerETCDKey); err != nil {
return err
}
return nil return nil
} }